Page 1 of 16 1234511 ... LastLast
Results 1 to 10 of 158
  1. Collapse Details
    Sony NEX/Axx Firmware hacking
    #1
    Junior Member
    Join Date
    Aug 2011
    Posts
    3
    Default
    Hi,

    I have started firmware hacking project, current plan is to dump and decrypt complete firmware.
    Currently I'm reversing flashing protocol used for FW upgrading, hoping for some undocumented commands.
    Also as mentioned on WIKI, XORing firmware files produces short blocks of clear text.
    This suggests file isn't really encrypted, just XORed with pseudo-random sequence that is static among ALL compatible cameras.
    After some research, I found this is same for all Alpha Axx and NEX series. This indicates common firmware is used in all these models.
    Pattern is different for compact cameras like HX5 and VG video cameras.
    From parts of firmware, I can see there is debug console with commands to read/write memory and other interesting stuff.


    So far, I have found one interesting feature in Firmware updater:
    Create empty FirmwareUpdater.log file in updater directory (where SPUFirmwareUpdater.exe is).
    When updater finds this file, it will be used for nicely detailed debug logging of all data send and received.
    I have already updated my camera firmware, but if anyone here will be doing firmware upgrade (Axx,NEX or LA-EA1),
    please enable logging and upload the log. It will greatly help me with understanding the protocol.

    EDIT: If you can, run firmware updater on already updated camera (just to the point it says camera version, then close it).
    I have only NEX3 log file, logs for other cameras are welcome (even without actual flashing).


    More good stuff will come soon...


    p.s. I'm well known for other similar projects, but Sony isn't really happy when hackers are having fun and likes to sue and cause problems...
    So I will be posting under this new user without any link to my previous work.
    Last edited by Nexus7; 08-25-2011 at 01:04 PM.


    Reply With Quote
     

  2. Collapse Details
    #2
    Junior Member
    Join Date
    Aug 2011
    Posts
    3
    Default
    There is this this nice connector in VG10 with two UARTs and even JTAG port.
    In firmware, there is 112500Bd console active on one UART with servicing commands and possible shell access.
    Also it may be possible to read full flash image using JTAG or upload dumper code to RAM and execute it.
    There are also test points for all these pins, some near CPU, some directly behind connector.
    Similar connector is in NEX series, but I don't have LEVEL 2 service manual to confirm it.
    Attached Images Attached Images


    Reply With Quote
     

  3. Collapse Details
    #3
    Junior Member
    Join Date
    Sep 2011
    Posts
    3
    Default
    Is it safe (and do you want) to spread this information on other forums?


    Reply With Quote
     

  4. Collapse Details
    #4
    Low Budget Ninja Nathyn's Avatar
    Join Date
    Mar 2004
    Location
    Chicago, USA
    Posts
    4,105
    Default
    Hack the VG10 to do 24p. You know you want to.

    -Nate

    MAKE YOUR MOVIE NOW!

    Writer/Director/Producer/Editor/Composer/Prop Master/Action Hero
    Canon T3i/Apple Final Cut Studio 2/After Effects CS3/Action Essentials 2/Garageband 4.1.2

    The Fourth Beast-2003 | Wages of Sin -2007 | Epitaph: Bread and Salt -2011


    Reply With Quote
     

  5. Collapse Details
    #5
    Junior Member
    Join Date
    Sep 2011
    Posts
    1
    Default
    I'm waiting with baited breath for your offerings!.. the nex 3 and 5 are both very highly specified cameras and it is very clear sony have held back on features via their firmware to create product differentiation, and make their new nex c3 and 5n more appealing. the nex3 would benefit very much from the manual shutter/iso control during video mode.. at the moment it goes stright to auto, and you cannot set a fixed iso or shutter. also, higher bitrates, and a non cropped video mode would be welcomed. I bought the nex3 for the apsc sensor, but they only give me 2/3 of it when i am in video mode! are you any further on the project? im sure many would be willing to make donations to your cause, instead of buying a new 5n, nex 7 or c3, which technically are no better than the originals!


    Reply With Quote
     

  6. Collapse Details
    #6
    Dark Side of the Camera Postmaster's Avatar
    Join Date
    Nov 2007
    Location
    Germany
    Posts
    5,317
    Default
    I wish someone would hack the FS100.

    Frank
    frankglencairn.wordpress.com
    http://twitter.com/FrankGlencairn



    Real men edit their films in a hex editor.


    Reply With Quote
     

  7. Collapse Details
    #7
    Junior Member
    Join Date
    Dec 2011
    Posts
    1
    Default
    Hi I am a NEX3 owner who really wants to have remote trigger via the UART that you mentioned before. This would allow things like triggertrap to control an NEX camera! Any updates on the hack?


    Reply With Quote
     

  8. Collapse Details
    #8
    Senior Member robmneilson's Avatar
    Join Date
    Dec 2007
    Location
    Houston Texas, by way of Brooklyn NY!
    Posts
    2,026
    Default
    Quote Originally Posted by Postmaster View Post
    I wish someone would hack the FS100.

    Frank
    If someone would undertake this, I would gladly donate many tens of dollars!
    "That's what happened to this friend of mine. So he had a lobotomy. Now he's well again."
    http://www.robmneilson.com


    Reply With Quote
     

  9. Collapse Details
    #9
    Junior Member
    Join Date
    Jan 2012
    Posts
    7
    Default
    Confirmation of the nice connector on Nex-3/5 for the Image Processor, contains JTAG, UART0 and UART1 (UART2 is pin 3 & 4 of the lens connector) for the Image Processor - http://i.imgur.com/hv4sz.jpg

    Main CPU JTAG is on the underside - http://i.imgur.com/8WoJS.jpg

    Service Manuals (level 2 and 3) for Nex-3/5 can be found at http://www.2shared.com/file/k4EZ0W0m/Sony_nex-3-5_service_manual.html

    Would love to see a FirmwareUpdater.log file, any further progress regarding the firmware decryption?


    Reply With Quote
     

  10. Collapse Details
    #10
    Senior Member kyle.presley's Avatar
    Join Date
    Feb 2006
    Location
    Chatsworth, GA
    Posts
    717
    Default
    Quote Originally Posted by robmneilson View Post
    If someone would undertake this, I would gladly donate many tens of dollars!
    Me too! Vitaliy?
    Yeah, the village called; they want their idiot back.


    Reply With Quote
     

Page 1 of 16 1234511 ... LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •